RHBA-2015:1315 - Bug Fix Advisory

Topic

Updated jss packages that fix two bugs and add one enhancement are now available
for Red Hat Enterprise Linux 6.

Description

Java Security Services (JSS) provides an interface between Java Virtual Machine
and Network Security Services (NSS). It supports most of the security standards
and encryption technologies supported by NSS including communication through
SSL/TLS network protocols. JSS is primarily utilized by the Certificate Server
as a part of the Identity Management System.

This update fixes the following bugs:

• Previously, the HASH_ALGORITHM constant was defined incorrectly. As a

consequence, object identifiers (OIDs) for SHA-256, SHA-384, and SHA-512 hash
functions were incorrect. With this update, the underlying source code has been
modified, and the mentioned OIDs are now correct. (BZ#1190302)

• Prior to this update, the source code for JSS was missing a condition for

validating the key strength for the RC4 software stream cipher. As a
consequence, JSS did not validate the key strength properly. A patch has been
applied to fix this bug, and JSS now performs key strength validation checks as
expected. (BZ#1190303)

In addition, this update adds the following enhancement:

• The Tomcat service has been updated to support the Transport Layer Security

cryptographic protocol version 1.1 (TLSv1.1) and the Transport Layer Security
cryptographic protocol version 1.2 (TLSv1.2) using JSS. (BZ#1167470)

Users of jss are advised to upgrade to these updated packages, which fix these
bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1190302 - Incorrect OIDs for SHA2 algorithms
• BZ - 1190303 - Key strength validation is not performed for RC4 algorithm

CVEs

(none)

References

(none)